CVE-2026-45809: OpenSIPS SIP Server DoS Vulnerability

CVE-2026-45809 Overview

CVE-2026-45809 is a stack buffer overflow vulnerability in OpenSIPS, an open-source Session Initiation Protocol (SIP) server implementation. The flaw resides in the watcherinfo XML generation functionality of the presence module. Versions prior to 3.6.6 and 4.0.0-rc1 are affected. A remote unauthenticated attacker can send a SUBSCRIBE request with an oversized From URI, then trigger presence.winfo generation for the same presentity. OpenSIPS copies the stored watcher URI into a fixed-size stack buffer, overflowing it and crashing the worker process. The issue is tracked as [CWE-121] Stack-based Buffer Overflow.

Critical Impact
Remote unauthenticated attackers can crash OpenSIPS worker processes, resulting in denial of service against SIP telephony infrastructure that exposes handle_subscribe() with watcherinfo generation enabled.

Affected Products

OpenSIPS versions prior to 3.6.6
OpenSIPS 4.0.0 pre-release versions prior to 4.0.0-rc1
Deployments with presence and presence_xml modules loaded

Discovery Timeline

2026-08-05 - CVE-2026-45809 published to the National Vulnerability Database
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-45809

Vulnerability Analysis

The vulnerability exists in modules/presence/notify.c within the watcherinfo XML generation path. OpenSIPS stores watcher subscription state, including the From URI of each subscriber. When a client requests presence.winfo generation for a presentity, OpenSIPS iterates stored watchers and copies each watcher URI into a fixed 200-byte stack buffer named content. No length check is performed against the source URI. An attacker who first submits a SUBSCRIBE with a From URI longer than 200 bytes causes the subsequent winfo build to overrun the stack buffer, corrupting the worker's stack frame and crashing the process.

Root Cause

The root cause is an unbounded copy of attacker-controlled data into a fixed-size stack buffer. The declaration char content[200]; sized the destination to a value smaller than SIP URIs permitted by the protocol. Because watcher state persists between the initial SUBSCRIBE and the winfo generation step, the malicious URI reaches the vulnerable copy even when the two operations occur in different transactions.

Attack Vector

Exploitation requires network reachability to a SIP endpoint that routes SUBSCRIBE requests through handle_subscribe() with the presence and presence_xml modules loaded. The attacker sends a SUBSCRIBE with Event: presence and an oversized From URI, then triggers watcherinfo XML generation for the same presentity. No authentication or user interaction is required.

// Patch excerpt: modules/presence/notify.c
// Removal of the undersized fixed stack buffer
 	xmlDocPtr doc = NULL;
     xmlNodePtr root_node = NULL, node = NULL;
 	xmlNodePtr w_list_node = NULL;
-	char content[200];
 	str *body= NULL;
 	char* buffer= NULL;
 	watcher_t* w;
// Source: https://github.com/OpenSIPS/opensips/commit/c5970d3ee25b457ad2d78fe6e9662a12dae577cd

The patch removes the fixed 200-byte stack buffer and replaces the copy path with a dynamically sized allocation that accommodates arbitrary URI lengths. See the OpenSIPS Security Advisory GHSA-gx83-2gh8-7v56 for the complete change set.

Detection Methods for CVE-2026-45809

Indicators of Compromise

OpenSIPS worker process crashes or segmentation faults correlated with recent SUBSCRIBE traffic
SIP SUBSCRIBE messages containing abnormally long From URIs, particularly exceeding 200 bytes
Repeated SUBSCRIBE followed by winfo-triggering requests targeting the same presentity from a single source
Gaps in presence event processing or restarted worker PIDs in OpenSIPS logs

Detection Strategies

Parse SIP traffic on ports 5060/5061 and alert on SUBSCRIBE requests whose From header URI exceeds 200 characters
Monitor OpenSIPS process supervision logs for abnormal worker restarts following SUBSCRIBE activity
Correlate SUBSCRIBE-then-winfo request patterns from unauthenticated sources against baseline presence traffic

Monitoring Recommendations

Enable verbose logging for the presence and presence_xml modules during triage
Forward SIP proxy logs and OpenSIPS core dumps to centralized log analysis for signature development
Track packet captures on SIP-facing interfaces to preserve evidence of oversized URI payloads

How to Mitigate CVE-2026-45809

Immediate Actions Required

Upgrade OpenSIPS to version 3.6.6 or 4.0.0-rc1 or later without delay
Inventory OpenSIPS deployments and confirm whether presence and presence_xml modules are loaded
Restrict inbound SIP SUBSCRIBE traffic to trusted networks until patching completes

Patch Information

OpenSIPS resolved the flaw in versions 3.6.6 and 4.0.0-rc1. The fix removes the fixed-size char content[200] stack buffer in modules/presence/notify.c and switches to dynamic sizing. Review the upstream commits c5970d3 and dd86461 for the full patch content.

Workarounds

Unload the presence and presence_xml modules if watcherinfo functionality is not required
Block SUBSCRIBE requests with From URIs exceeding a conservative length at an upstream SIP proxy or SBC
Restrict handle_subscribe() routing to authenticated peers only

bash

# Example SIP proxy filter: reject oversized From URIs before they reach OpenSIPS
# Applied at an upstream SBC or opensips.cfg routing block
if (is_method("SUBSCRIBE")) {
    if ($(fu{s.len}) > 200) {
        sl_send_reply("400", "From URI too long");
        exit;
    }
}